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REMARKS 

Claims 1-4, 6-36, and 38-67 are pending in this application. Claim 67 is added herein. 
Support for the new claim may be found in the claims as originally filed. Reconsideration is 
requested based on the foregoing amendment and the following remarks. 

Response to Arguments: 

The Applicants appreciate the consideration given to their arguments. Further 
reconsideration is requested. 

Claim Rejections - 35 U.S.C. § 103: 

Claims 1, 2, 33, 34, and 65 were rejected under 35 U.S.C. § 103(a) as unpatentable over 
"Statistical Traffic Modeling for Network Intrusion Detection," to Cabrera etaL, (hereinafter 
"Cabrera"), in view of "Artificial Neural Networks for Misuse Detection," to Cannady, (hereinafter 
"Cannady"), U.S. Patent No. 6,928,554 to Dettinger etaL , (hereinafter "Dettinger"), U.S. Patent 
Publication No. 2002/0107953 to Ontiverso et al. (hereinafter "Ontiverso"), and U.S. Patent No. 
6,609,154 to Fuh et al. , (hereinafter "Fuh"). The rejection is traversed. 

To serve as anticipating references, non-patent references such a Cabrera and Cannady 
must enable that which it is asserted to anticipate. "A claimed invention cannot be anticipated by 
a prior art reference if the allegedly anticipatory disclosures cited as prior art are not enabled." 
Amgen, Inc. v. Hoechst Marion Roussel, Inc. , 314 F.3d 1313, 1354, 65 USPQ2d 1385, 1416 
(Fed. Cir. 2003). See Bristol-Myers Squibb v. Ben Venue Laboratories, Inc. , 246 F.3d 1368, 
1374, 58 USPQ2d 1508, 1512 (Fed. Cir. 2001) ("To anticipate the reference must also enable 
one of skill in the art to make and use the claimed invention."); PPG Industries, Inc. v. Guardian 
Industries Corp. , 75 F.3d 1558, 1566, 37 USPQ2d 1618, 1624 (Fed. Cir. 1996) ("To anticipate a 
claim, a reference must disclose every element of the challenged claim and enable one skilled in 
the art to make the anticipating subject matter."). Elan Pharmaceuticals Inc. v. Mayo Foundation 
for Medical Education and Research, 68 USPQ2d 1373 (CAFC 2003): 

Non-patent references such a Cabrera and Cannady often merely report results 
achieved, but fail to enable one of skill in the art to make and use the processes used to achieve 
those results. Section 3 of Canady, in fact, may be seen to be devoted to inputs and outputs, Le. 
results. Furthermore, non-patent references such a Cabrera and Cannady, often do not inform 
persons of skill in the art how to make and use their process, as would be required of a 
comparable patent. 
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Non-patent references, however, are held to substantially the same standards as are 
patent disclosures when they are used as prior art. In this case, although Cabrera mentions, in 
the Introduction, two types of Intrusion Detection Systems (IDS) at page 466, La "misuse 
detection," and "anomaly detection," no person of skill in the art would gain an understanding of 
how to make and use either one, based on their mention in Cabrera. 

Similarly, although Cannady mentions two similar types of IDS at, for example, section 
1 .1 , no person of skill in the art would gain an understanding of how to make and use either one, 
based on their mention in Cannady, either. Neither Cabrera nor Cannady, rather, describe the 
particulars of how an IDS might work, beyond simply naming them. Cabrera and Cannady, are, 
therefore, submitted to be invalid references for use in a rejection under 35 U.S.C. § 103(a). 

Claim 1: 

Claim 1 recites: 

An illegal pattern database which stores patterns of illegal accesses to the server. 

Neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh teach, disclose, or suggest "an illegal 
pattern database which stores patterns of illegal accesses to the server," as recited in claim 1 . 

Although Cabrera, in particular, mentions misuse detection in passing in the first column 
at page 466, he dismisses it in favor of a variation on anomaly detection, which he calls novel 
attacks, in the second column at page 466. No library, which the final Office Action analogizes to 
the illegal pattern database of the claimed invention, is used in anomaly detection at all. Rather, 
as described at page 466, one models the normal behavior of the system. 

Cannady, similarly, mentions misuse detection and anomaly detection as well, but rejects 
them both in favor of neural-network based solution, as described at section 2. Cannady, in 
particular, uses a neural network to identify the typical characteristics of system users and 
identify statistically significant variations from the user's established behavior, La anomaly 
detection, as described at Section 1 .3. Neural networks are the opposite of rule-based systems, 
in that the neural network is expected to learn what an attack looks like as it goes along, rather 
than referring to some pre-determined set of rules. 

Dettinger, for its part, implements algorithms for detecting selected security violation 
patterns, as described in the Abstract, not "an illegal pattern database which stores patterns of 
illegal accesses to the server," as recited in claim 1. 
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Ontiverso, similarly, denies access to data packets from a specific source if it is 
determined that the source is sending unauthorized data (e.g., suspicious data or a denial of 
sen/ice attack), as described in the Abstract, not "an illegal pattern database which stores 
patterns of illegal accesses to the server," as recited in claim 1 . 

Finally, in Fuh, as described at column 9, lines 51-67, 

Access control lists filter packets and can prevent certain packets from entering or 
exiting a network. Each ACL is a list of information that firewall router 210 may 
use to determine whether packets arriving at or sent from a particular interface 
may be communicated within or outside the firewall router. For example, in an 
embodiment, input ACL 424 may comprise a list of IP addresses and types of 
allowable client protocols. Assume that firewall router 210 receives an inbound 
packet from client 306 at external interface 420 that is intended for target server 
222. If the IP address of client 306 is not stored in input ACL 424, then firewall 
router 210 will not forward the packet further within the circuitry or software of the 
firewall router. Output ACL 426 similarly controls the delivery of packets from 
firewall router 210 to resources located outside external interface 420. Input ACL 
428 and output ACL 430 govern packet flow to or from internal interface 422. 

Thus, input ACL 424 maintains a list of IP addresses and types of allowable client protocols. 
Allowable is not illegal. This is to be contrasted with claim 1 , in which patterns of illegal 
accesses to the server are stored in an illegal pattern database. Since neither Cabrera, 
Cannady, Dettinger, Ontiverso, nor Fuh teach, disclose, or suggest "an illegal pattern database 
which stores patterns of illegal accesses to the server," as recited in claim 1 , their combination 
cannot either. Thus, even if Cabrera, Cannady, Dettinger, Ontiverso, and Fuh were combined, 
as proposed in the final Office Action, the claimed invention would not result. 

Claim 1 recites further: 

A pattern estimation unit which estimates legality of an access request based on 
the illegal access patterns stored in the illegal pattern database and on a 
predetermined pattern estimation rule. 

Since neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh teach, disclose, or suggest "an 
illegal pattern database which stores patterns of illegal accesses to the server," as discussed 
above, none of them can show "a pattern estimation unit which estimates legality of an access 
request based on the illegal access patterns stored in the illegal pattern database," as recited in 
claim 1 , either. 

Claim 1 recites further: 

A pattern determination unit which determines whether each access request is to 
be transmitted to the server based on the estimation by the pattern estimation unit 
and on a predetermined pattern determination rule, the pattern determination unit 
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producing a determination result. 

Since neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh teach, disclose, or suggest "an 
illegal pattern database which stores patterns of illegal accesses to the server," as discussed 
above, none of them can show "a pattern determination unit which determines whether each of 
the access request is to be transmitted to the server based on the estimation by the pattern 
estimation unit and on a predetermined pattern determination rule," as recited in claim 1, either. 

Furthermore, claim 1 recites: 

A transmission unit which controls transmission of the access request based on 
determination result of the pattern determination unit. 

Since neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh teach, disclose, or suggest "an 
illegal pattern database which stores patterns of illegal accesses to the server," as discussed 
above, none of them can show "a transmission unit which controls transmission of the access 
request based on determination result of the pattern determination unit," as recited in claim 1, 
either. 

Finally, modifying Cabrera as proposed in the final Office Action would change the 
principle of operation of Cabrera, as well as rendering Cabrera unsuitable for its intended 
purpose, both of which are prohibited by the M.P.E.P § 2143.01. 

Cabrera, in particular, seeks to quantify the effectiveness of Network Activity Models, Le. 
the normal behavior of the system, in discriminating normal connections from attack 
connections, as described in the Abstract at page 466. Cabrera, to this purpose, gives up on 
misuse detection, Le. a rule-based system, as incapable of dealing with or preventing attacks 
that deviate slightly from known rules, as described at page 466, in the second column. To 
modify Cabrera as proposed in the final Office Action, on the other hand, would force Cabrera to 
use the rule-based approach already found wanting. 

It is submitted, therefore, that persons of ordinary skill in the art at the time the invention 
was made would not have been motivated to combine the references, as proposed in the final 
Office Action, since to do so would have changed the principle of operation of Cabrera, as well 
as rendering Cabrera unsuitable for its intended purpose, in contravention of M.P.E.P § 2143.01. 
Claim 1 is submitted to be allowable. Withdrawal of the rejection of claim 1 is earnestly solicited. 

Claim 2 depends from claim 1 and adds further distinguishing elements. Claim 2 is thus 
also submitted to be allowable. Withdrawal of the rejection of claim 2 is also earnestly solicited. 
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Claims 33 and 34: 

Claim 33 recites: 

A pattern estimation unit which estimates legality of an access request based on 
the illegal access patterns stored in the illegal pattern database and on a 
predetermined pattern estimation rule. 

Neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh teach, disclose, or suggest "an illegal 
pattern database which stores patterns of illegal accesses to the server," as discussed above 
with respect to the rejection of claim 1 . Since none of the references show "an illegal pattern 
database which stores patterns of illegal accesses to the server," none of them can show "a 
pattern estimation unit which estimates legality of an access request based on the illegal access 
patterns stored in the illegal pattern database and on a predetermined pattern estimation rule," 
as recited in claim 33, either. 

Claim 33 recites further: 

A pattern determination unit which determines whether each of the access 
request is to be transmitted to the server based on the estimation by the pattern 
estimation unit and on a predetermined pattern determination rule. 

Neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh teach, disclose, or suggest "an illegal 
pattern database which stores patterns of illegal accesses to the server," as discussed above 
with respect to the rejection of claim 1 . Since none of the references show "an illegal pattern 
database which stores patterns of illegal accesses to the server," none of them can show "a 
pattern determination unit which determines whether each of the access request is to be 
transmitted to the server based on the estimation by the pattern estimation unit and on a 
predetermined pattern determination rule," as recited in claim 33, either. 

Claim 33 recites further: 

A pattern determination step of determining whether the access request is to be 
transmitted to the server based on an estimation result at the pattern estimation 
step and on a predetermined pattern determination rule. 

Neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh teach, disclose, or suggest "an illegal 
pattern database which stores patterns of illegal accesses to the server," as discussed above 
with respect to the rejection of claim 1 . Since none of the references show "an illegal pattern 
database which stores patterns of illegal accesses to the server," none of them can show "a 
pattern determination step of determining whether the access request is to be transmitted to the 
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server based on an estimation result at the pattern estimation step," as recited in claim 33, 
either. 

Finally, claim 33 recites: 

A transmission controlling step of controlling transmission of the access request 
based on determination result of the pattern determination step so as to transmit 
the access request to the server when the access request is estimated to be 
legal, and so as to reject transmission of the access request to the server and so 
as to abandon the request when the access request is estimated to be illegal. 

Neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh teach, disclose, or suggest "an illegal 
pattern database which stores patterns of illegal accesses to the server," as discussed above 
with respect to the rejection of claim 1 . Since none of the references show "an illegal pattern 
database which stores patterns of illegal accesses to the server," none of them can show "a 
transmission controlling step of controlling transmission of the access request based on 
determination result of the pattern determination step so as to transmit the access request to the 
server when the access request is estimated to be legal," as recited in claim 33, either. Claim 33 
is submitted to be allowable. Withdrawal of the rejection of claim 33 is earnestly solicited. 

Claim 34 depends from claim 33 and adds further distinguishing elements. Claim 34 is 
thus also submitted to be allowable. Withdrawal of the rejection of claim 34 is also earnestly 
solicited. 

Claims 65: 

Claim 65 recites: 

A pattern estimation step of referring to an illegal pattern database which stores 
patterns of illegal accesses to the server, and estimating legality of an access 
request based on the illegal access patterns referred to and on a predetermined 
pattern estimation rule. 

Neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh teach, disclose, or suggest "an illegal 
pattern database which stores patterns of illegal accesses to the server," as discussed above 
with respect to the rejection of claim 1 . Since none of the references show "an illegal pattern 
database which stores patterns of illegal accesses to the server," none of them can show "a 
pattern estimation step of referring to an illegal pattern database which stores patterns of illegal 
accesses to the server, and estimating legality of an access request based on the illegal access 
patterns referred to and on a predetermined pattern estimation rule," as recited in claim 65, 
either. 

Claim 65 recites further: 
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A pattern determination step of determining whether the access request is to be 
transmitted to the server based on an estimation result at the pattern estimation 
step and on a predetermined pattern determination rule. 

Neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh teach, disclose, or suggest "an illegal 
pattern database which stores patterns of illegal accesses to the server," as discussed above 
with respect to the rejection of claim 1 . Since none of the references show "an illegal pattern 
database which stores patterns of illegal accesses to the server," none of them can show "a 
pattern determination step of determining whether the access request is to be transmitted to the 
server based on an estimation result at the pattern estimation step and on a predetermined 
pattern determination rule," as recited in claim 65, either. Carter does not either, and thus 
cannot make up for this deficiency of Fuh with respect to claim 65. 

Finally, claim 65 recites: 

A transmission controlling step of controlling transmission of the access request 
based on determination result of the pattern determination step so as to transmit 
the access request to the server when the access request is estimated to be 
legal, and so as to reject transmission of the access request to the server and so 
as to abandon the request when the access request is estimated to be illegal. 

Neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh teach, disclose, or suggest "an illegal 
pattern database which stores patterns of illegal accesses to the server," as discussed above 
with respect to the rejection of claim 1 . Since none of the references show "an illegal pattern 
database which stores patterns of illegal accesses to the server," none of them can show "a 
transmission controlling step of controlling transmission of the access request based on 
determination result of the pattern determination step so as to transmit the access request to the 
server when the access request is estimated to be legal, and so as to reject transmission of the 
access request to the server and so as to abandon the request when the access request is 
estimated to be illegal," as recited in claim 65, either. Claim 65 is submitted to be allowable. 
Withdrawal of the rejection of claim 65 is earnestly solicited. 

Claim 66: 

Claim 66 was rejected under 35 U.S.C. § 103 as being unpatentable over Cabrera in 
view of Cannady and Fuh. The rejection is traversed. Reconsideration is earnestly solicited. 

Claim 66 recites: 

Storing a pattern of illegal accesses to a server in an illegal pattern database. 
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Neither Cabrera, Cannady, nor Fuh teach, disclose, or suggest "storing a pattern of illegal 
accesses to a server in an illegal pattern database," as discussed above with respect to the 
rejection of claim 1 . 

Claim 66 recites further: 

Estimating a legality of the access request based on the illegal access pattern 
stored in the illegal pattern database and on a predetermined pattern estimation 
rule. 

Neither Cabrera, Cannady, nor Fuh teach, disclose, or suggest "an illegal pattern database 
which stores patterns of illegal accesses to the server," as discussed above with respect to the 
rejection of claim 1 . Since none of the references show "an illegal pattern database which stores 
patterns of illegal accesses to the server," none of them can show "estimating a legality of the 
access request based on the illegal access pattern stored in the illegal pattern database and on 
a predetermined pattern estimation rule," as recited in claim 66, either. 

Finally, claim 66 recites: 

Determining whether the access request is to be transmitted to the server based 
on the estimate of the legality of the access request. 

Neither Cabrera, Cannady, nor Fuh teach, disclose, or suggest "an illegal pattern database 
which stores patterns of illegal accesses to the server," as discussed above with respect to the 
rejection of claim 1 . Since none of the references show "an illegal pattern database which stores 
patterns of illegal accesses to the server," none of them can show "determining whether the 
access request is to be transmitted to the server based on the estimate of the legality of the 
access request," as recited in claim 66, either. Claim 66 is submitted to be allowable as well, for 
at least those reasons discussed above with respect to claim 1 . Withdrawal of the rejection of 
claim 66 is earnestly solicited. 

Claims 3. 4, 6-19, 26-30, 35, 36, 38-47, 48-51, and 58-62: 

Claims 3, 4, 6-19, 26-30, 35, 36, 38-47, 48-51, and 58-62 were rejected under 35 U.S.C. 
§ 103 as being unpatentable over Cabrera, Cannady, Dettinger, Ontiverso, and Fuh in view of 
US 2003/0051026 to Carter et al. (hereinafter "Carter"). The rejection is traversed. 
Reconsideration is earnestly solicited. 

Claims 3, 4, 6-19 and 26-30 depend from claim 1 and add further distinguishing 
elements. Neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh teach, disclose, or suggest 
"an illegal pattern database which stores patterns of illegal accesses to the server," as discussed 
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above with respect to the rejection of claim 1 . Carter does not either, and thus cannot make up 
for this deficiency of Cabrera, Cannady, Dettinger, Ontiverso, and Fuh with respect to claims 3, 
4, 6-1 9 and 26-30. 

Furthermore, neither Cabrera, Cannady, Dettinger, Ontiverso, Dettinger, Ontiverso, nor 
Fuh teach, disclose, or suggest "an illegal pattern database which stores patterns of illegal 
accesses to the server," as discussed above with respect to the rejection of claim 1 . Carter does 
not either, and thus cannot make up for this deficiency of Cabrera, Cannady, Dettinger, 
Ontiverso, and Fuh with respect to claims 3, 4, 6-19 and 26-30. 

Finally, neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh teach, disclose, or 
suggest "a pattern estimation unit which estimates legality of an access request based on the 
illegal access patterns stored in the illegal pattern database," as discussed above with respect to 
the rejection of claim 1 . Carter does not either, and thus cannot make up for this deficiency of 
Cabrera, Cannady, Dettinger, Ontiverso, and Fuh with respect to claims 3, 4, 6-19 and 26-30. 
Thus, even if Cabrera, Cannady, Dettinger, Ontiverso, Fuh and Carter were combined as 
proposed in the final Office Action, the claimed invention would not result. Claims 3, 4, 6-19 and 
26-30 are submitted to be allowable. Withdrawal of the rejection of claims 3, 4, 6-19 and 26-30 
is earnestly solicited. 

Finally, the final Office Action provides no motivation or suggestion to combine the 
teachings of Fuh and Carter as required by 35 U.S.C. § 103(a) and the M.P.E.P. §706.02(j)(D), 
beyond an assertion that "(o)ne of ordinary skill in the art at the time of the invention would have 
been motivated to make the above mentioned modifications for the reasons discussed in Carter, 
Paragraph [0005]". 

In paragraph [0005], however, Carter discusses only a knowledge base, and declares 
wistfully that such a knowledge base should "respond to and learn from new events." That's 
nice, but Carter fails to mention any reason at all to include a pattern estimation unit which 
estimates legality of an access request based on the illegal access patterns stored in the illegal 
pattern database, as recited in claim 1 . Thus, even if persons of ordinary skill in the art would 
have been motivated by paragraph [0005] of Carter at the time of the invention, there's no 
reason to believe the claimed invention would be at all the result. Claims 3, 4, 6-19 and 26-30 
are thus also submitted to be allowable. Withdrawal of the rejection of claims 3, 4, 6-19 and 26- 
30 is earnestly solicited. 
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Claims 35. 36. 38-47. 48-51. and 58-62: 

Claims 35, 36, 38-47, 48-51, and 58-62 depend from claim 33 and add further 
distinguishing elements. 

Neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh teach, disclose, or suggest "a 
pattern estimation unit which estimates legality of an access request based on the illegal access 
patterns stored in the illegal pattern database and on a predetermined pattern estimation rule," 
as discussed above with respect to the rejection of claim 33. Carter does not either, and thus 
cannot make up for this deficiency of Cabrera, Cannady, Dettinger, Ontiverso, and Fuh with 
respect to claims 35, 36, 38-47, 48-51, and 58-62. 

Furthermore, neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh teach, disclose, or 
suggest "a pattern determination unit which determines whether each of the access request is to 
be transmitted to the server based on the estimation by the pattern estimation unit and on a 
predetermined pattern determination rule," as discussed above with respect to the rejection of 
claim 33. Carter does not either, and thus cannot make up for this deficiency of Cabrera, 
Cannady, Dettinger, Ontiverso, and Fuh with respect to claims 35, 36, 38-47, 48-51 , and 58-62. 

Furthermore, neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh teach, disclose, or 
suggest "a pattern determination step of determining whether the access request is to be 
transmitted to the server based on an estimation result at the pattern estimation step and on a 
predetermined pattern determination rule," as discussed above with respect to the rejection of 
claim 33. Carter does not either, and thus cannot make up for this deficiency of Cabrera, 
Cannady, Dettinger, Ontiverso, and Fuh with respect to claims 35, 36, 38-47, 48-51, and 58-62. 

Finally, neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh teach, disclose, or 
suggest "a transmission controlling step of controlling transmission of the access request based 
on determination result of the pattern determination step so as to transmit the access request to 
the server when the access request is estimated to be legal, and so as to reject transmission of 
the access request to the server and so as to abandon the request when the access request is 
estimated to be illegal," as discussed above with respect to the rejection of claim 33. Carter 
does not either, and thus cannot make up for this deficiency of Cabrera, Cannady, Dettinger, 
Ontiverso, and Fuh with respect to claims 35, 36, 38-47, 48-51 , and 58-62. Thus, even if 
Cabrera, Cannady, Dettinger, Ontiverso, Fuh and Carter were combined as proposed in the final 
Office Action, the claimed invention would not result. Claims 35, 36, 38-47, 48-51, and 58-62 
are submitted to be allowable. Withdrawal of the rejection of claims 35, 36, 38-47, 48-51 , and 
58-62 is earnestly solicited. 
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Finally, the final Office Action provides no motivation or suggestion to combine the 
teachings of Fuh and Carter as required by 35 U.S.C. § 103(a) and the M.REP. §706.02(j)(D), 
beyond an assertion that "(o)ne of ordinary skill in the art at the time of the invention would have 
been motivated to make the above mentioned modifications for the reasons discussed in Carter, 
Paragraph [0005]", as discussed above. 

Claims 31. 32, 63. and 64: 

Claims 31, 32, 63, and 64 were rejected under 35 U.S.C. § 103 as being unpatentable 
over Cabrera, Cannady, Dettinger, Ontiverso, Fuh, and Carter, and further in view of US 
6,535,855 to Cahill et al. (hereinafter "Cahill"). The rejection is traversed. Reconsideration is 
earnestly solicited. 

Claims 31 and 32 depend from claim 1 and add further distinguishing elements. 

Neither Cabrera, Cannady, Dettinger, Ontiverso, Fuh, nor Carter teach, disclose, or 
suggest "an illegal pattern database which stores patterns of illegal accesses to the server," as 
discussed above with respect to the rejection of claim 1 . Cahill does not either, and thus cannot 
make up for this deficiency of Cabrera, Cannady, Dettinger, Ontiverso, Fuh, and Carter with 
respect to claims 31 and 32. 

Furthermore, neither Cabrera, Cannady, Dettinger, Ontiverso, Fuh, nor Carter teach, 
disclose, or suggest "an illegal pattern database which stores patterns of illegal accesses to the 
server," as discussed above with respect to the rejection of claim 1 . Cahill does not either, and 
thus cannot make up for this deficiency of Cabrera, Cannady, Dettinger, Ontiverso, Fuh, and 
Carter with respect to claims 31 and 32. 

Finally, neither Cabrera, Cannady, Dettinger, Ontiverso, Fuh, nor Carter teach, disclose, 
or suggest "a pattern estimation unit which estimates legality of an access request based on the 
illegal access patterns stored in the illegal pattern database," as discussed above with respect to 
the rejection of claim 1 . Cahill does not either, and thus cannot make up for this deficiency of 
Cabrera, Cannady, Dettinger, Ontiverso, Fuh, and Carter with respect to claims 31 and 32. 

Thus, even if Cabrera, Cannady, Dettinger, Ontiverso, Fuh, Carter and Cahill were 
combined as proposed in the final Office Action, the claimed invention would not result. Claims 
31 and 32 are submitted to be allowable. Withdrawal of the rejection of claims 31 and 32 is 
earnestly solicited. 

Finally, the final Office Action provides no motivation or suggestion to combine the 
teachings of Fuh, Carter and Cahill as required by 35 U.S.C. § 103(a) and the M.RE.R 
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§706.02(j)(D), beyond an assertion that "(o)ne of ordinary skill in the art at the time of the 
invention would have been motivated to make the above mentioned modifications for the 
reasons discussed in Carter, Paragraph [0026]". 

In paragraph [0026], however, Carter merely opines that monitoring and protecting 
network communication over the Internet is a major purpose of network surveillance and security 
systems. Network surveillance and security systems are nice, but Carter fails to mention any 
reason at all to include a pattern estimation unit which estimates legality of an access request 
based on the illegal access patterns stored in the illegal pattern database, as recited in claim 1. 
Thus, even if persons of ordinary skill in the art would have been motivated by paragraph [0026] 
of Carter at the time of the invention, there's no reason to believe the claimed invention would be 
at all the result. Claims 31 and 32 are thus also submitted to be allowable. Withdrawal of the 
rejection of claims 31 and 32 is earnestly solicited. 

Claims 63 and 64: 

Claims 63 and 64 depend from claim 33 and add further distinguishing elements. 

Neither Cabrera, Cannady, Dettinger, Ontiverso, Fuh, nor Carter teach, disclose, or 
suggest "a pattern estimation unit which estimates legality of an access request based on the 
illegal access patterns stored in the illegal pattern database and on a predetermined pattern 
estimation rule," as discussed above with respect to the rejection of claim 33. Neither Carter nor 
Cahill do not either, and thus cannot make up for this deficiency of Cabrera, Cannady, Dettinger, 
Ontiverso, and Fuh with respect to claims 63 and 64. 

Furthermore, neither Cabrera, Cannady, Dettinger, Ontiverso, Fuh, nor Carter teach, 
disclose, or suggest "a pattern determination unit which determines whether each of the access 
request is to be transmitted to the server based on the estimation by the pattern estimation unit 
and on a predetermined pattern determination rule," as discussed above with respect to the 
rejection of claim 33. Neither Carter nor Cahill do not either, and thus cannot make up for this 
deficiency of Cabrera, Cannady, Dettinger, Ontiverso, and Fuh with respect to claims 63 and 64. 

Furthermore, neither Cabrera, Cannady, Dettinger, Ontiverso, Fuh, nor Carter teach, 
disclose, or suggest "a pattern determination step of determining whether the access request is 
to be transmitted to the server based on an estimation result at the pattern estimation step and 
on a predetermined pattern determination rule," as discussed above with respect to the rejection 
of claim 33. Neither Carter nor Cahill do not either, and thus cannot make up for this deficiency 
of Cabrera, Cannady, Dettinger, Ontiverso, and Fuh with respect to claims 63 and 64. 
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Finally, neither Cabrera, Cannady, Dettinger, Ontiverso, Fuh, nor Carter teach, disclose, 
or suggest "a transmission controlling step of controlling transmission of the access request 
based on determination result of the pattern determination step so as to transmit the access 
request to the server when the access request is estimated to be legal, and so as to reject 
transmission of the access request to the server and so as to abandon the request when the 
access request is estimated to be illegal," as discussed above with respect to the rejection of 
claim 33. Neither Carter nor Cahill do not either, and thus cannot make up for this deficiency of 
Cabrera, Cannady, Dettinger, Ontiverso, and Fuh with respect to claims 63 and 64. Thus, even 
if Cabrera, Cannady, Dettinger, Ontiverso, Fuh, Carter and Cahill were combined as proposed in 
the final Office Action, the claimed invention would not result. Claims 63 and 64 are submitted to 
be allowable. Withdrawal of the rejection of claims 63 and 64 is earnestly solicited. 

Finally, the final Office Action provides no motivation or suggestion to combine the 
teachings of Fuh, Carter and Cahill as required by 35 U.S.C. § 103(a) and the M.P.E.P. 
§706.02(j)(D), beyond an assertion that M (o)ne of ordinary skill in the art at the time of the 
invention would have been motivated to make the above mentioned modifications for the 
reasons discussed in Carter, Paragraph [0026]", as discussed above. 

Claims 20,21.52 and 53: 

Claims 20, 21, 52 and 53 were rejected under 35 U.S.C. § 103 as being unpatentable 
over Cabrera, Cannady, Dettinger, Ontiverso, and Fuh in view of US 2002/0165894 to Kashani 
et al. (hereinafter "Kashani"). The rejection is traversed to the extent it might apply to the claims 
as amended. Reconsideration is earnestly solicited. 

Claims 20 and 21 depend from claim 1 and add further distinguishing elements. Neither 
Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh show "an illegal pattern database which stores 
patterns of illegal accesses to the server," as discussed above with respect to the rejection of 
claim 1 . Kashani does not either, and thus cannot make up for this deficiency of Cabrera, 
Cannady, Dettinger, Ontiverso, and Fuh with respect to claims 20 and 21 . 

Furthermore, neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh show "an illegal 
pattern database which stores patterns of illegal accesses to the server," as discussed above 
with respect to the rejection of claim 1 . Kashani does not either, and thus cannot make up for 
this deficiency of Cabrera, Cannady, Dettinger, Ontiverso, and Fuh with respect to claims 20 and 
21. 
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Finally, Fuh neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh show "a pattern 
estimation unit which estimates legality of an access request based on the illegal access 
patterns stored in the illegal pattern database," as discussed above with respect to the rejection 
of claim 1 . Kashani does not either, and thus cannot make up for this deficiency of Cabrera, 
Cannady, Dettinger, Ontiverso, and Fuh with respect to claims 20 and 21. Thus, even if 
Cabrera, Cannady, Dettinger, Ontiverso, Fuh and Kashani were combined as proposed in the 
final Office Action, the claimed invention would not result. Claims 20 and 21 are submitted to be 
allowable. Withdrawal of the rejection of claims 20 and 21 is earnestly solicited. 

Claims 52 and 53: 

Claims 52 and 53 depend from claim 33 and add further distinguishing elements. Neither 
Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh show "a pattern estimation unit which estimates 
legality of an access request based on the illegal access patterns stored in the illegal pattern 
database and on a predetermined pattern estimation rule," as discussed above with respect to 
the rejection of claim 33. Neither Carter nor Kashani do either, and thus cannot make up for this 
deficiency of Fuh with respect to claims 52 and 53. 

Furthermore, Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh show "a pattern 
determination unit which determines whether each of the access request is to be transmitted to 
the server based on the estimation by the pattern estimation unit and on a predetermined pattern 
determination rule," as discussed above with respect to the rejection of claim 33. Kashani does 
not either, and thus cannot make up for this deficiency of Cabrera, Cannady, Dettinger, 
Ontiverso, and Fuh with respect to claims 52 and 53. 

Furthermore, neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh show "a pattern 
determination step of determining whether the access request is to be transmitted to the server 
based on an estimation result at the pattern estimation step and on a predetermined pattern 
determination rule," as discussed above with respect to the rejection of claim 33. Kashani does 
not either, and thus cannot make up for this deficiency of Cabrera, Cannady, Dettinger, 
Ontiverso, and Fuh with respect to claims 52 and 53. 

Finally, neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh show "a transmission 
controlling step of controlling transmission of the access request based on determination result 
of the pattern determination step so as to transmit the access request to the server when the 
access request is estimated to be legal, and so as to reject transmission of the access request 
to the server and so as to abandon the request when the access request is estimated to be 
illegal," as discussed above with respect to the rejection of claim 33. Kashani does not either, 
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and thus cannot make up for this deficiency of Cabrera, Cannady, Dettinger, Ontiverso, and Fuh 
with respect to claims 52 and 53.Thus, even if Cabrera, Cannady, Dettinger, Ontiverso, Fuh, and 
Kashani were combined as proposed in the final Office Action, the claimed invention would not 
result. Claims 52 and 53 are submitted to be allowable. Withdrawal of the rejection of claims 52 
and 53 is earnestly solicited. 

Claims 22-25 and 54-57: 

Claims 22-25 and 54-57 were rejected under 35 U.S.C. § 103 as being unpatentable over 
Cabrera, Cannady, Dettinger, Ontiverso, and Fuh in view of Carter, and further in view of US 
2002/0165894 to Kashani et al. (hereinafter "Kashani"). The rejection is traversed. 
Reconsideration is earnestly solicited. 

Claims 22-25 depend from claim 1 and add further distinguishing elements. Neither 
Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh show "an illegal pattern database which stores 
patterns of illegal accesses to the server," as discussed above with respect to the rejection of 
claim 1 . Neither Carter nor Kashani do either, and thus cannot make up for this deficiency of 
Cabrera, Cannady, Dettinger, Ontiverso, and Fuh with respect to claims 22-25. 

Furthermore, neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh show "an illegal 
pattern database which stores patterns of illegal accesses to the server," as discussed above 
with respect to the rejection of claim 1 . Neither Carter nor Kashani do not either, and thus 
cannot make up for this deficiency of Cabrera, Cannady, Dettinger, Ontiverso, and Fuh with 
respect to claims 22-25. 

Finally, neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh show "a pattern 
estimation unit which estimates legality of an access request based on the illegal access 
patterns stored in the illegal pattern database," as discussed above with respect to the rejection 
of claim 1 . Neither Carter nor Kashani do not either, and thus cannot make up for this deficiency 
of Cabrera, Cannady, Dettinger, Ontiverso, and Fuh with respect to claims 22-25. Thus, even if 
Cabrera, Cannady, Dettinger, Ontiverso, Fuh, Carter and Kashani were combined as proposed 
in the final Office Action, the claimed invention would not result. Claims 22-25 are submitted to 
be allowable. Withdrawal of the rejection of claims 22-25 is earnestly solicited. 

Claims 54-57: 

Claims 54-57 depend from claim 33 and add further distinguishing elements. 
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Neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh show "a pattern estimation unit 
which estimates legality of an access request based on the illegal access patterns stored in the 
illegal pattern database and on a predetermined pattern estimation rule," as discussed above 
with respect to the rejection of claim 33. Neither Carter nor Kashani do either, and thus cannot 
make up for this deficiency of Cabrera, Cannady, Dettinger, Ontiverso, and Fuh with respect to 
claims 54-57. 

Furthermore, neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh show "a pattern 
determination unit which determines whether each of the access request is to be transmitted to 
the server based on the estimation by the pattern estimation unit and on a predetermined pattern 
determination rule," as discussed above with respect to the rejection of claim 33. Neither Carter 
nor Kashani do not either, and thus cannot make up for this deficiency of Cabrera, Cannady, 
Dettinger, Ontiverso, and Fuh with respect to claims 54-57. 

Furthermore, neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh show "a pattern 
determination step of determining whether the access request is to be transmitted to the server 
based on an estimation result at the pattern estimation step and on a predetermined pattern 
determination rule," as discussed above with respect to the rejection of claim 33. Neither Carter 
nor Kashani do not either, and thus cannot make up for this deficiency of Cabrera, Cannady, 
Dettinger, Ontiverso, and Fuh with respect to claims 54-57. 

Finally, neither Cabrera, Cannady, Dettinger, Ontiverso, nor Fuh show "a transmission 
controlling step of controlling transmission of the access request based on determination result 
of the pattern determination step so as to transmit the access request to the server when the 
access request is estimated to be legal, and so as to reject transmission of the access request 
to the server and so as to abandon the request when the access request is estimated to be 
illegal," as discussed above with respect to the rejection of claim 33. Neither Carter nor Kashani 
do not either, and thus cannot make up for this deficiency of Cabrera, Cannady, Dettinger, 
Ontiverso, and Fuh with respect to claims 54-57. Thus, even if Cabrera, Cannady, Dettinger, 
Ontiverso, Fuh, Carter and Kashani were combined as proposed in the final Office Action, the 
claimed invention would not result. Claims 54-57 are submitted to be allowable. Withdrawal of 
the rejection of claims 54-57 is earnestly solicited. 

New claim 67: 

None of the cited references teach, disclose, or suggest "estimating a legality of an 
access request based on an illegal access pattern stored in an illegal pattern database and on a 
predetermined pattern estimation rule, and determining whether the access request is to be 
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abandoned based on the estimate of the legality of the access request," as recited in claim 67. 
Claim 67 is thus believed to be allowable. 

Conclusion: 

Accordingly, in view of the reasons given above, it is submitted that all of claims 1-4, 6- 
36, and 38-67 are allowable over the cited references. Allowance of all claims 1-4, 6-36, and 38- 
67 and of this entire application is therefore respectfully requested. 

If there are any formal matters remaining after this response, the Examiner is requested 
to telephone the undersigned to attend to these matters. 

If there are any additional fees associated with filing of this Amendment, please charge 
the same to our Deposit Account No. 19-3935, 



Respectfully submitted, 





Registration No. 37,889 



1201 New York Ave, N.W., 7th Floor 
Washington, D.C. 20005 
Telephone: (202)434-1500 
Facsimile: (202)434-1501 
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